Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-92707 EUVD-2026-102315GHSA-qhrr-8q5h-9q3h

MessagePack: Nested arrays can blow past buffer length limits

Published Oct 15, 2026 · Updated Oct 15, 2026 · Assigned by GitHub_M

Vendor: MessagePack-CSharp Product: MessagePack-CSharp Package: dotnet10 Package: dotnet10-runtime Package: dotnet11 Package: dotnet6 Package: dotnet7 Package: dotnet8 Package: dotnet8-runtime Package: dotnet9-runtime Package: MessagePack Package: python-msgpack Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: NuGet Ecosystem: Ubuntu

Description

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] from each declared array length before the configured object-graph depth limit rejects the input, while nested array headers can reuse the same trailing unread bytes to satisfy per-header length validation. A comparatively small payload can therefore keep many large arrays alive at once. When an attacker can submit such data repeatedly, the allocations can cause severe managed-heap pressure, excessive garbage collection, process termination, or loss of service. Exposure requires an application to deserialize untrusted data through the affected formatter path and permit repeated attacker-controlled submissions, such as a reachable ASP.NET Core SignalR hub method with an object parameter and AddMessagePackProtocol() enabled. This issue is fixed in versions 2.5.303 and 3.1.9.

Affected products

VendorProductAffectedFixed
MessagePack-CSharp MessagePack-CSharp < 2.5.303, >= 3.0.0, < 3.1.9 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 dotnet10 10.0.113-10.0.13-0ubuntu1~26.10.1 USN-8942-1
Ubuntu 26.10 dotnet11 11.0.100-11.0.0~rc2-0ubuntu1~26.10.1 USN-8942-1
Ubuntu 26.04 LTS dotnet10 10.0.113-10.0.13-0ubuntu1~26.04.1 USN-8942-1
Ubuntu 24.04 LTS dotnet10 10.0.113-10.0.13-0ubuntu1~24.04.1 USN-8942-1
Ubuntu 24.04 LTS dotnet8 8.0.132-8.0.32-0ubuntu1~24.04.1 USN-8942-1
Ubuntu 22.04 LTS dotnet6 +1 No fix yet —
Ubuntu 22.04 LTS dotnet8 8.0.132-8.0.32-0ubuntu1~22.04.1 USN-8942-1

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 dotnet-host +8 10.0.13-1.el10_2 ALSA-2026:86195
AlmaLinux 10 dotnet-hostfxr-8.0 +7 8.0.32-1.el10_2 ALSA-2026:86168
AlmaLinux 10 dotnet-hostfxr-9.0 +7 9.0.21-1.el10_2 ALSA-2026:86172
AlmaLinux 10 dotnet-sdk-10.0 +4 10.0.113-1.el10_2 ALSA-2026:86195
AlmaLinux 10 dotnet-sdk-8.0 +3 8.0.132-1.el10_2 ALSA-2026:86168
AlmaLinux 10 dotnet-sdk-9.0 +5 9.0.122-1.el10_2 ALSA-2026:86172
AlmaLinux 9 dotnet-host +8 10.0.13-1.el9_8 ALSA-2026:86193
AlmaLinux 9 dotnet-hostfxr-8.0 +7 8.0.32-1.el9_8 ALSA-2026:86169
AlmaLinux 9 dotnet-hostfxr-9.0 +7 9.0.21-1.el9_8 ALSA-2026:86171
AlmaLinux 9 dotnet-sdk-10.0 +4 10.0.113-1.el9_8 ALSA-2026:86193
AlmaLinux 9 dotnet-sdk-8.0 +3 8.0.132-1.el9_8 ALSA-2026:86169
AlmaLinux 9 dotnet-sdk-9.0 +5 9.0.122-1.el9_8 ALSA-2026:86171
AlmaLinux 8 dotnet +5 10.0.113-1.el8_10 ALSA-2026:86192
AlmaLinux 8 dotnet-hostfxr-10.0 +7 10.0.13-1.el8_10 ALSA-2026:86192
AlmaLinux 8 dotnet-hostfxr-8.0 +7 8.0.32-2.el8_10 ALSA-2026:86594
AlmaLinux 8 dotnet-hostfxr-9.0 +7 9.0.21-1.el8_10 ALSA-2026:86170
AlmaLinux 8 dotnet-sdk-8.0 +3 8.0.132-2.el8_10 ALSA-2026:86594
AlmaLinux 8 dotnet-sdk-9.0 +5 9.0.122-1.el8_10 ALSA-2026:86170

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 dotnet10.0 10.0.113-1.el10_2 RLSA-2026:86195
Rocky Linux 10 dotnet8.0 8.0.132-1.el10_2 RLSA-2026:86168
Rocky Linux 10 dotnet9.0 9.0.122-1.el10_2 RLSA-2026:86172
Rocky Linux 9 dotnet10.0 10.0.113-1.el9_8 RLSA-2026:86193
Rocky Linux 9 dotnet8.0 8.0.132-1.el9_8 RLSA-2026:86169
Rocky Linux 9 dotnet9.0 9.0.122-1.el9_8 RLSA-2026:86171
Rocky Linux 8 dotnet10.0 10.0.113-1.el8_10 RLSA-2026:86192
Rocky Linux 8 dotnet8.0 8.0.132-2.el8_10 RLSA-2026:86594
Rocky Linux 8 dotnet9.0 9.0.122-1.el8_10 RLSA-2026:86170

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 dotnet10-runtime 10.0.13-r0 —
Alpine v3.24 dotnet8-runtime 8.0.32-r0 —
Alpine v3.24 dotnet9-runtime 9.0.21-r0 —
Alpine v3.23 dotnet10-runtime 10.0.13-r0 —
Alpine v3.23 dotnet8-runtime 8.0.32-r0 —
Alpine v3.23 dotnet9-runtime 9.0.21-r0 —
Alpine v3.22 dotnet8-runtime 8.0.32-r0 —
Alpine v3.22 dotnet9-runtime 9.0.21-r0 —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 python-msgpack No fix yet —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 dotnet-host +8 10.0.13-1.0.1.el10_2 ELSA-2026-86195
Oracle Linux 10 dotnet-hostfxr-8.0 +7 8.0.32-1.0.1.el10_2 ELSA-2026-86168
Oracle Linux 10 dotnet-hostfxr-9.0 +7 9.0.21-1.0.1.el10_2 ELSA-2026-86172
Oracle Linux 10 dotnet-sdk-10.0 +4 10.0.113-1.0.1.el10_2 ELSA-2026-86195
Oracle Linux 10 dotnet-sdk-8.0 +3 8.0.132-1.0.1.el10_2 ELSA-2026-86168
Oracle Linux 10 dotnet-sdk-9.0 +5 9.0.122-1.0.1.el10_2 ELSA-2026-86172
Oracle Linux 9 dotnet-host +8 10.0.13-1.0.1.el9_8 ELSA-2026-86193
Oracle Linux 9 dotnet-hostfxr-8.0 +7 8.0.32-1.0.1.el9_8 ELSA-2026-86169
Oracle Linux 9 dotnet-hostfxr-9.0 +7 9.0.21-1.0.1.el9_8 ELSA-2026-86171
Oracle Linux 9 dotnet-sdk-10.0 +4 10.0.113-1.0.1.el9_8 ELSA-2026-86193
Oracle Linux 9 dotnet-sdk-8.0 +3 8.0.132-1.0.1.el9_8 ELSA-2026-86169
Oracle Linux 9 dotnet-sdk-9.0 +5 9.0.122-1.0.1.el9_8 ELSA-2026-86171
Oracle Linux 8 dotnet +5 10.0.114-1.0.2.el8_10 ELSA-2026-86192
Oracle Linux 8 dotnet-host +8 10.0.14-1.0.2.el8_10 ELSA-2026-86192
Oracle Linux 8 dotnet-hostfxr-8.0 +7 8.0.32-2.0.1.el8_10 ELSA-2026-86594
Oracle Linux 8 dotnet-hostfxr-9.0 +7 9.0.21-1.0.1.el8_10 ELSA-2026-86170
Oracle Linux 8 dotnet-sdk-8.0 +3 8.0.132-2.0.1.el8_10 ELSA-2026-86594
Oracle Linux 8 dotnet-sdk-9.0 +5 9.0.122-1.0.1.el8_10 ELSA-2026-86170

Affected packages

EcosystemPackageAffectedFixedRecord
NuGet MessagePack < 2.5.303 2.5.303 GHSA-qhrr-8q5h-9q3h
NuGet MessagePack >= 3.0.0, < 3.1.9 3.1.9 GHSA-qhrr-8q5h-9q3h

Advisories 30

References